# When Defenders Take Two Hours and Attackers Take Twenty-Nine Minutes
That gap — between how fast attackers move and how long defenders take to respond — is the actual crisis hiding inside a new survey of security operations teams. Prophet Security's *State of AI in Security Operations 2026*, drawn from responses from more than 250 cybersecurity professionals, lands at a moment when AI adoption in the SOC has crossed from experiment to mainstream. The numbers it surfaces are worth sitting with, because some of them are genuinely alarming.
Start with the breakout-time problem. Threat intelligence has long tracked how fast an intruder can pivot from initial access to lateral movement once they're inside a network — that number has been shrinking for years, and current estimates put the fastest threat actors at around 29 minutes. Now look at what the survey found on the defender side: the average time to investigate a single alert runs 75 minutes, and alerts often sit untouched for close to an hour before anyone opens them. Do the arithmetic. By the time a mid-size security team completes a thorough triage cycle, the attacker who triggered the first alert has potentially finished breakfast and started on their second target.
## The Alert You Never Saw
The headline finding isn't the AI adoption rate. It's this: 40% of organizations have disabled specific security alerts because they didn't have the staff to read them.
That sentence deserves to be read slowly. These aren't teams that tuned out noisy, low-fidelity detections through careful detection engineering — a legitimate and necessary practice. These are teams that switched off coverage because nobody had time. The distinction matters enormously. A detection rule generating 500 false positives for every real threat is a candidate for tuning. A detection rule that's generating real signal but getting ignored is a different problem entirely — and turning it off doesn't solve it, it hides it.
About 28% of alerts are never investigated. For 60% of respondents, a missed or ignored alert later became a real incident — a breach, downtime, or worse. A third of those respondents said it happened three or more times last year. These aren't hypothetical risks. They're past failures that organizations are reporting with uncomfortable candor.
Volume numbers give context. Average teams deal with around 100 alerts per day; larger enterprises often face close to 1,000. Team size hasn't kept pace — many SOCs are running on skeleton crews of fewer than ten analysts. The workload math simply doesn't add up, and it hasn't for years.
## AI Shows Up, and It's Actually Working
Against that backdrop, the adoption numbers tell an important story. Forty percent of security teams now use AI in their SOC daily. Another 56% are actively piloting it. Only 4% have no adoption plans — a figure that will shrink further as competitive pressure mounts.
For teams already deployed, the results are real. Nearly three-quarters report AI has cut investigation time by at least 25%, which translates to roughly 25 minutes returned on every alert. That's not a rounding error — it's the difference between a team that can work through their queue and one that can't. Teams also report better around-the-clock coverage, fewer false positives reaching analysts, and more capacity for the contextual reasoning that machines still struggle with.
This matters because the reasonable critics of AI security tools have long argued they produce their own alert fatigue through over-triggering. The survey suggests that at the deployment maturity most of these teams have reached, the net effect is positive. Alert volume is a solvable problem if the filter actually works.
## Building Your Own AI Is a Worse Bet Than It Looks
One of the more useful findings is the failure rate on DIY projects. Nearly three-quarters of AI-using security teams attempted to build internal tools. Almost half of those — 46% — were eventually abandoned, never made production, or got replaced by a commercial product.
The nuance worth noting: build-your-own teams reported investigation-time improvements at roughly the same rate as everyone else (73% versus 72%). The difference wasn't initial performance. It was durability. In-house AI projects require ongoing maintenance, model updates, threat feed integration, and dedicated engineering resources that most security teams don't have. Vendors specializing in security AI amortize those costs across hundreds of customers. An internal tooling project competes for headcount against active incident response — and loses, repeatedly.
This doesn't mean every SOC should abandon custom development. Organizations with genuine ML engineering capacity and a clear use case can build effective tools. But the data suggests the "we'll build our own" instinct — common in security teams with a strong self-reliance culture — is producing a lot of sunken investment.
## AI Versus AI: The Arms Race Is Already Here
Fifty-six percent of respondents reported seeing AI-driven attacks increase over the past year. The leading categories: AI-generated phishing, deepfake audio and video in social engineering, large-scale credential stuffing, and AI-synthesized malware. Finance and healthcare see the heaviest exposure.
This isn't future-state. Defenders are already operating in an environment where the phishing email their analysts review was drafted by a language model, the voice on the executive deepfake call was synthesized from public audio, and the malware variant they're trying to classify was generated specifically to evade current signatures. The asymmetry AI introduces for defenders — faster investigation, better coverage — is being partially offset by what it gives attackers, who now have tools that compress the time and skill required to execute sophisticated campaigns.
That both "securing AI systems" and "using AI for security" now rank as top organizational priorities — outpacing traditional concerns like cloud security — reflects this dual reality. The shift isn't just about adding capability. It's about defending an attack surface that didn't exist three years ago.
---
## HackWire Analysis
The disabled-alerts admission is the buried story here, and it deserves more scrutiny than a single data point in a vendor report.
When 40% of organizations confirm they've switched off detections due to staffing constraints, they're describing a silent expansion of their attack surface. More importantly, they're describing a process failure that AI alone won't fix. AI reduces investigation time once an alert fires. It helps with triage and contextualization. What it can't do is retroactively surface the attack that slipped through a detection gap nobody was monitoring.
The comparison to SOC operations five years ago is instructive. In 2019–2020, the dominant complaint was alert fatigue — too many notifications, too little signal, burned-out analysts. The standard response was aggressive detection tuning and SIEM optimization. What this survey suggests is that some teams, rather than engineering their way to better signal-to-noise, chose the easier path: stop watching certain channels entirely. AI adoption fixes the triage problem for alerts that do fire. It doesn't restore coverage gaps created by turning things off.
There's also something revealing in the DIY failure rate that the report doesn't quite surface. Security teams that built and abandoned their own AI tools still reported solid investigation-time gains before abandonment — meaning the value was real, but the operational model was wrong. The lesson isn't that AI doesn't work in-house. It's that running an AI product requires a product team, and most security organizations aren't structured that way. Buying isn't always smarter than building; but building without a maintenance plan is almost always expensive.
Defenders in finance and healthcare — which the survey flags as the sectors seeing the sharpest AI-driven attack increases — should treat the disabled-alert finding as a prompt to audit their current detection coverage. Not against a framework benchmark, but against what's actually enabled versus what's actually being processed. That gap is the real exposure. AI narrows it from one side. Knowing what you turned off narrows it from the other.
— HackWire Editorial
---
## Related Coverage